🚀 go-pugleaf

The facts:

 * I posted article <CIE792.DL2>, which said in its entirety:
    > Does anyone have any proof *yet* that Rabbit Network is
    > not a front for John Palmer?

 * Someone posted a forgery <CIE792.DM2>.  It had the same
   headers as my valid message (except for the message ID).
   It said in its entirety:
    > Does anyone have any proof *yet* that I am not a fuckhead?

 * Alerted by E-Mail about the forgery, I solicited as many copies
   of it as people would send me.

 * All copies of the forgery had Path: headers ending with the string
   "usenet.ins.cwru.edu!ncoast!fin!chip".  CWRU does talk to ncoast.
   So the path up through "ncoast" seemed real.  But my site, fin,
   doesn't talk to ncoast.

 * The news log at CWRU reports receiving the forgery from ncoast;
   it seems genuine.

 * The news log at ncoast reports receiving the forgery from fin,
   which is impossible, since fin and ncoast aren't connected.
    > Dec 23 04:26:23.000 fin + <CIE792.DM2@fin.uucp> \
       comstar devon keinstr pcohio sgtech usenet

 * The UUCP log at ncoast reports that tygra connected just before
   the forgery was injected.  And tygra had permissions for the
   "rnews" command.

 * Tygra is John Palmer's machine.

Reconstruction of events:

  1. I posted an article that embarrassed John Palmer.
  2. John Palmer altered the article to create a forgery which
     he assumed would embarrass me.
  3. John Palmer injected the forgery at ncoast in such a way
     as to make it appear to have come from fin!chip.

Fallout so far:

  * Richard Garret, admin of ncoast, has stopped tygra from
    executing "rnews" any more.

Suggestion:

  * Any and all systems that talk to tygra should stop doing so.
    John Palmer has shown himself to be a loose cannon; he is
    likely to cause trouble for anyone providing him a feed.

    I know that Palmer can use accounts on other machines to get
    news access; but forgery without root privileges is rather
    more of a challenge, and is usually easier to trace.

Thank you for your attention.
-- 
Chip Salzenberg         <chip%fin.uucp@dg-rtp.dg.com> or <dg-rtp!fin!chip>